Overview
overview
10Static
static
3Unconfirme...77.zip
windows7-x64
1Unconfirme...77.zip
windows10-2004-x64
1Reaper/Bin...er.exe
windows7-x64
1Reaper/Bin...er.exe
windows10-2004-x64
3Reaper/Eas...ts.dll
windows7-x64
1Reaper/Eas...ts.dll
windows10-2004-x64
1Reaper/Reaper.exe
windows7-x64
10Reaper/Reaper.exe
windows10-2004-x64
10Reaper/Rea...config
windows7-x64
3Reaper/Rea...config
windows10-2004-x64
3Reaper/Scr...3.0.js
windows7-x64
1Reaper/Scr...3.0.js
windows10-2004-x64
1Reaper/Scr...bot.js
windows7-x64
1Reaper/Scr...bot.js
windows10-2004-x64
1Reaper/Scr...nt.txt
windows7-x64
1Reaper/Scr...nt.txt
windows10-2004-x64
1Reaper/Scr...ll.txt
windows7-x64
1Reaper/Scr...ll.txt
windows10-2004-x64
Reaper/Scr...al.txt
windows7-x64
1Reaper/Scr...al.txt
windows10-2004-x64
1Reaper/Scr...er.txt
windows7-x64
1Reaper/Scr...er.txt
windows10-2004-x64
1Reaper/Scr...Tp.txt
windows7-x64
1Reaper/Scr...Tp.txt
windows10-2004-x64
1Reaper/Scr...bot.js
windows7-x64
1Reaper/Scr...bot.js
windows10-2004-x64
1Reaper/Scr... v2.js
windows7-x64
1Reaper/Scr... v2.js
windows10-2004-x64
1Reaper/Scr...y 2.js
windows7-x64
1Reaper/Scr...y 2.js
windows10-2004-x64
1Reaper/Scr... V3.js
windows7-x64
1Reaper/Scr... V3.js
windows10-2004-x64
1Analysis
- max time kernel
151s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 12:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Unconfirmed 139577.zip
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Unconfirmed 139577.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Reaper/Bin/FpsUnlocker.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Reaper/Bin/FpsUnlocker.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
Reaper/EasyExploits.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Reaper/EasyExploits.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Reaper/Reaper.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral8
Sample
Reaper/Reaper.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral9
Sample
Reaper/Reaper.exe.config
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral10
Sample
Reaper/Reaper.exe.config
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
Reaper/Scripts/Aimbot 3.0.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Reaper/Scripts/Aimbot 3.0.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Reaper/Scripts/Aimbot.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Reaper/Scripts/Aimbot.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Reaper/Scripts/Alt+Print.txt
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Reaper/Scripts/Alt+Print.txt
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Reaper/Scripts/Arsenal Kill All.txt
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Reaper/Scripts/Arsenal Kill All.txt
Resource
win10v2004-20240319-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Reaper/Scripts/Arsenal.txt
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
Reaper/Scripts/Arsenal.txt
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
Reaper/Scripts/ArsenalHitboxExtender.txt
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
Reaper/Scripts/ArsenalHitboxExtender.txt
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
Reaper/Scripts/BRM5 Tp.txt
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Reaper/Scripts/BRM5 Tp.txt
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Reaper/Scripts/CC Aimbot.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Reaper/Scripts/CC Aimbot.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Reaper/Scripts/Dex Explorer v2.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Reaper/Scripts/Dex Explorer v2.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Reaper/Scripts/Mad City 2.js
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Reaper/Scripts/Mad City 2.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Reaper/Scripts/TopKek V3.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Reaper/Scripts/TopKek V3.js
Resource
win10v2004-20240319-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Reaper/Bin/FpsUnlocker.exe
- Size 488KB
- Sample240404-n75pcafc65
- SHA256 d0685e397486bd9f54eda33133e87e3970dedf5038ef0e4d058de34d796d72ac
- MD5 52f46ced3b06b19eac3369fbdb4ee2ee
- SHA1 1bc549fa770b1bf3925248a3853a87af9948381f
- SHA512 d65a7f73a497e18d0123306c3e940cdd5b22f61ad88fcd9a334c95bab0db665a8e61d11c9c78a656cbfdd7a691e782351fa712aa97c6f38f1d641ae91e3d23af
- SSDEEP 6144:9nsLTb6hU1R1IDT3nn/b10WyIZUdA8CQ3mAg0y0Noh+p9NWRzbX:6TbgrDT3n/b6qiA8CQqvYogp/6
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4704 msedge.exe 4704 msedge.exe 4964 msedge.exe 4964 msedge.exe 2288 identity_helper.exe 2288 identity_helper.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe 4108 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3028 wrote to memory of 4964 3028 FpsUnlocker.exe 91 PID 3028 wrote to memory of 4964 3028 FpsUnlocker.exe 91 PID 4964 wrote to memory of 3800 4964 msedge.exe 92 PID 4964 wrote to memory of 3800 4964 msedge.exe 92 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 760 4964 msedge.exe 95 PID 4964 wrote to memory of 4704 4964 msedge.exe 96 PID 4964 wrote to memory of 4704 4964 msedge.exe 96 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97 PID 4964 wrote to memory of 3952 4964 msedge.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\Reaper\Bin\FpsUnlocker.exe"C:\Users\Admin\AppData\Local\Temp\Reaper\Bin\FpsUnlocker.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/axstin/rbxfpsunlocker/releases2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x7c,0x108,0x7ffd5a4046f8,0x7ffd5a404708,0x7ffd5a4047183⤵PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5982535053369585359,14751708626019318060,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:23⤵PID:760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,5982535053369585359,14751708626019318060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,5982535053369585359,14751708626019318060,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:83⤵PID:3952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5982535053369585359,14751708626019318060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:13⤵PID:5112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5982535053369585359,14751708626019318060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:13⤵PID:1120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5982535053369585359,14751708626019318060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:13⤵PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5982535053369585359,14751708626019318060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:13⤵PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,5982535053369585359,14751708626019318060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 /prefetch:83⤵PID:4236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,5982535053369585359,14751708626019318060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5982535053369585359,14751708626019318060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:13⤵PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5982535053369585359,14751708626019318060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:13⤵PID:3404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5982535053369585359,14751708626019318060,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3304 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4108
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4168
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
- Size 1KB
- SHA256 b9818abdd546e92fddaec6bd85f7097d257e227168501a18618909674010047e
- MD5 4e9910ae7abcf8b74db8c616a21ad6c5
- SHA1 f73734d81ab9d769da765a08f719d9b312c4269f
- SHA512 1664008ef0f9bfccec9a0d4482ee55372fbc0c14d2d9c87f994167fb3c01e716288c854d7f866720785338db11fd8f009e088ed297c183ac1ecb56513220be74
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C38AC6B0EBDA4044A36E2ADF650F8E22
- Size 281B
- SHA256 842e2210f0a198efe27c1d920ac3a4c567b4834ee77d4479e815b37327ec8643
- MD5 ac9b99d9fc5e4d4c100eca6c51e8fae2
- SHA1 b56bc1c6a8f4d752c2a6e7a9fa4d3a826533faed
- SHA512 826bd9eb0de707979fe6f15ee95a4762ea0db91ddb18e52b297ca3beb94ea36d3507c09aabfe483b4dbaedbe4feaabc8f94416c698e73cf9335b20d846bbb3ed
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
- Size 979B
- SHA256 02c977774c4964285be3246cb98906b21a923c602b935d6636fc60969a99979e
- MD5 20e581c47c812b1ff83ca45a9c1f4f30
- SHA1 f698c78900e8f308ab70bc33f9047e79e6f61fcb
- SHA512 388b87a8f8d54f29756d509872b09036c0935d58e8fb53b14e3075da20905c6e5cc215210622a1d0d89bd9d6d20c2e1e415144c71ca4a5c189d43207f6d6f0c6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
- Size 482B
- SHA256 e0d3bc75c0bc680f312ae92ccea1d6be016da86f4126c9553234a951645e7bd3
- MD5 9b18fbf1e65bd5612a14db2ce6d74dff
- SHA1 da91ab0960d198bdc6d037ca686d0fcb63710422
- SHA512 97debcc57dc2476ba11b6d4ca15988ac9c47d162ea8573fd6cc09b4bc5fca856dfbe647d1a1985c06f94f52679c72f6d778ecf68c38a59898c3c4aa0f416026a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C38AC6B0EBDA4044A36E2ADF650F8E22
- Size 484B
- SHA256 b0125ba4bd0c57a0b527127b579e9a1798b8b597ab7620c3a661be99a1139f8c
- MD5 59506cadd3d478767279bde3d4a0182c
- SHA1 e2328e0fc19720f6ab68d384b1fbef898ea8bfe1
- SHA512 1e211187ab34d513aacd7ae320a695e4dab337977dd106c2a367b01c9f948f21ff22fb75f803d6d2b763d55a37161f2c823813030322fa2b02024e2803d5ff5e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
- Size 480B
- SHA256 d8a1ddd0f79b3e331c2b66e880a35b7c3e62b64123598e0ecc69813cb8b2a582
- MD5 6760f909b60fa3d6187f97dccccb6e4b
- SHA1 b032866acbd9e21c3a41cdfea5a38a58a8ae201a
- SHA512 f7a74230b2f9d0a8d3bd199b36e07015a0e5fdab154f14f1957df148b6f2f49d9e28742be712ab8cf4d0f92a3249f543835d5215a8a022232fad8be36f99cd88
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c
- MD5 1e3dc6a82a2cb341f7c9feeaf53f466f
- SHA1 915decb72e1f86e14114f14ac9bfd9ba198fdfce
- SHA512 0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae
- MD5 36bb45cb1262fcfcab1e3e7960784eaa
- SHA1 ab0e15841b027632c9e1b0a47d3dec42162fc637
- SHA512 02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 1KB
- SHA256 47402a3e7325c8556bb83ec2d129914a5fac672bca62ad6fbc505d9c428b371a
- MD5 ca9283790255dd786e66c0c998527e45
- SHA1 4da34def99ff72f50162bbc0cd0c93ded1de6f01
- SHA512 dcff430b99cbd94bae9218f28c4f25ee437e3274d4dea13539747b1237baad48ccb23b3adb6091cb78c0e85255e29ca5fdcf200c600f3057f6f99c2a43ab0654
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 496B
- SHA256 87226eb070e366b2f3c23900dbe849c7ad264ece26caf98d083019bfb0bbbc15
- MD5 f608725842a0185c9ee53fb7c5807e09
- SHA1 27e5f3c3f7e1056cb1e555cbbf8190f2336c2f13
- SHA512 3982ef3e4ce76cce6986b574cff9b9d8e7e9869fd9a6ddfb7f1c8fbfad9ae9abfd5b1bc171deaf5d3d4f672a28a02db5414d88b5c2a44fe684d995b6aec22104
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
- MD5 807419ca9a4734feaf8d8563a003b048
- SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
- SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 64e79a1cf7b0a6917852802e806a83376569f960bbb58617add7eacd79cd9e92
- MD5 84b452746fcca32b19dcd119e2f26bc4
- SHA1 5217f85f839766cf13950fb555631d49d1e4c59a
- SHA512 375f355162573e6f0ec08c115e84a2edfa2dbe2a4deb90db668279e459b3208a6453ae296c48ee445a294873b23a0e81bc22b43391147126f2c7f39f301a8873
- SSDEEP 96:nFkV31AJsV8wpvWMoiVmdeUuh1jCZqUWQyV+VD7AiEwb:nFk1+JsV8GWMkuhh/rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 a780bc298f4fea462e2103fcfb1b4257ad9c32901165c0da78ed59b58b7d3dbb
- MD5 a07126ddb29b43bfc3afc91298711e08
- SHA1 422214d4ede342c8ffc434e2792620c080b845e9
- SHA512 7869a97fe1f7cc2193b52270ba7b4c84a07f0c94093be09cc0b6d57cd376dd210d92ad5e1aef1abe2ce9a35892c02354b6b6cf4e4cbb8fa9db0172a3bedd6de2
- SSDEEP 96:nFkS31AZsV8wpvWMoiVmdeHCuqUWQyV+VD7ziEwb:nFkk+ZsV8GWMX0rt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 93326d24899e984ef0ed3f415dced15af88ad5d972738e795122edc7edfda6ac
- MD5 19e7b5818a8e14c390ecf5ceb6ff6105
- SHA1 e38293976e47809c49adfa5ec87ff5f61d0de97b
- SHA512 cfd07caa2bbdd40deb189f82c3d5f640e0440207062011be4990425cdaf175a5fb7455d9fa0da7421fe498a991b38c58737036c73ecb87b8636e9438579c7f7e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupce2RUQNvbqrGjKFGOz0c+p:A9iIxuERzA83h09RZxYCv+riMJzV+0K
- MD5 SHA1 SHA512 SSDEEP